Splunk Search

rex extraction of multiple fields from a record

Rob_Jordan
Explorer

While the following extraction below works, I wanted to see if I could extract both custom fields EAR_FILE and DOMAIN_NAME in one rex step instead of initiating a second search and rex command.

"Initiating redeploy*.ear" | rex field=_raw "(?<EAR_FILE>\w*\.ear)" | search "Initiating redeploy*.ear"| rex field=_raw "(?<DOMAIN_NAME>\w\wdomain\d\d)"

Sample Records:

<May 01, 2010 9:38:10 AM CDT> <Info> <J2EE Deployment SPI> <BEA-260121> <Initiating redeploy operation for application, MyApp [archive: /tmp/tsdomain01/upload/MyApp.ear], to configured targets.> 
<May 01, 2010 9:50:01 AM CDT> <Info> <J2EE Deployment SPI> <BEA-260121> <Initiating redeploy operation for application, YourApp [archive: /tmp/tsdomain02/upload/YourApp.ear], to configured targets.> 

Thank you,

Rob

Tags (2)
2 Solutions

dwaddle
SplunkTrust
SplunkTrust

Without seeing the original event, it's hard to make a regex to pull both. But, as a general rule, this is possible. As an example, for the event "Green Eggs and Ham" you could do a regex similar to:

| rex field=_raw "(?<egg_color>[^\s]+)[Ee]ggs and (?<meat_type>[^\s]+)"

If you're going to be doing this type of extraction on a regular basis, it might be worth it to read up on setting these up permanently in props.conf/transforms.conf.

View solution in original post

0 Karma

Rob_Jordan
Explorer

dwaddle, thanks for the help. Based on your example above, I was able to get it to work with the following.

"Initiating redeploy*.ear" | rex field=_raw "(?<DOMAIN_NAME>\w\wdomain\d\d)/.*/(?<EAR_FILE>\w*\.ear)"

View solution in original post

0 Karma

Rob_Jordan
Explorer

dwaddle, thanks for the help. Based on your example above, I was able to get it to work with the following.

"Initiating redeploy*.ear" | rex field=_raw "(?<DOMAIN_NAME>\w\wdomain\d\d)/.*/(?<EAR_FILE>\w*\.ear)"
0 Karma

dwaddle
SplunkTrust
SplunkTrust

Without seeing the original event, it's hard to make a regex to pull both. But, as a general rule, this is possible. As an example, for the event "Green Eggs and Ham" you could do a regex similar to:

| rex field=_raw "(?<egg_color>[^\s]+)[Ee]ggs and (?<meat_type>[^\s]+)"

If you're going to be doing this type of extraction on a regular basis, it might be worth it to read up on setting these up permanently in props.conf/transforms.conf.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...